The vulnerability stems from the Linux kernel’s netfilter flowtable code not enforcing the correct maximum number of hardware offload actions for IPv6 packets. While the taxonomy limits the table to sixteen actions, legitimate IPv6 configurations can require seventeen or more – for example, ethernet address mangling, SNAT, DNAT, double VLANs, and redirects each consume multiple payload actions. The unchecked count allows a kernel buffer overrun, which can corrupt kernel memory or trigger a panic. Because this occurs in privileged kernel space, an attacker could cause a denial‑of‑service or, if an additional step is leveraged, potentially execute code with root privileges.

All Linux systems running a kernel that implements netfilter’s flowtable offload for IPv6 traffic and has not yet integrated the fix that raises the limit to twenty‑four actions. The vendor indicated is "Linux:Linux", representing the Linux kernel itself; thus any distribution that includes the affected kernel version, regardless of distro name, is susceptible.

No CVSS rating is present, and the Exploit Prediction Scoring System (EPSS) score is unavailable, indicating no broad public exploitation data. The vulnerability is not listed in CISA KEV, suggesting it has not been observed in the wild. However, exploitation would likely require an attacker to craft network packets that deliver an oversized flowtable action list to the target. This is a network‑based attack vector. Given the kernel privilege context, the potential impact is large, so remaining unpatched systems could be at risk of a denial‑of‑service or, with further vulnerability exploitation, a privilege escalation.